Revert "Remove old docs." #30773
Revert "Remove old docs." #30773
Conversation
This reverts commit 3955b05.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const docType = hash.slice( 0, hash.indexOf( '/' ) + 1 ); | ||
| let docLink = hash.slice( hash.indexOf( '/' ) + 1 ); | ||
| docLink = docLink.slice( docLink.indexOf( '/' ) ); | ||
| location.href = docType + language + docLink; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium documentation
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the problem, we need to ensure that the language variable is properly sanitized before it is used to construct the URL. This can be achieved by validating the language variable against a predefined set of allowed values. If the value is not in the allowed set, we should either reject it or default to a safe value.
- Create a list of allowed language codes.
- Validate the
languagevariable against this list before using it to construct the URL. - If the
languagevariable is not valid, default to a safe value or handle the error appropriately.
| @@ -117,5 +117,11 @@ | ||
|
|
||
| const allowedLanguages = ['en', 'zh', 'fr', 'de', 'es']; // Add allowed language codes | ||
|
|
||
| function setLanguage( value ) { | ||
|
|
||
| language = value; | ||
| if (allowedLanguages.includes(value)) { | ||
| language = value; | ||
| } else { | ||
| language = 'en'; // Default to 'en' if the value is not valid | ||
| } | ||
|
|
| if ( search ) { | ||
|
|
||
| const link = sectionLink.href.split( /[?#]/ )[ 0 ]; | ||
| sectionLink.href = `${link}?q=${search}`; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium documentation
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the problem, we need to ensure that the user input is properly sanitized before being used to construct the URL. The best way to do this is to use a function that encodes the user input to make it safe for use in a URL. We can use the encodeURIComponent function to achieve this.
- We will modify the
updateFilterfunction to encode the user input before using it in the URL. - Specifically, we will change the line where the URL is constructed to use
encodeURIComponent(v).
| @@ -372,3 +372,3 @@ | ||
|
|
||
| window.history.replaceState( {}, '', '?q=' + v + window.location.hash ); | ||
| window.history.replaceState( {}, '', '?q=' + encodeURIComponent(v) + window.location.hash ); | ||
|
|
||
| @@ -420,3 +420,3 @@ | ||
| const link = sectionLink.href.split( /[?#]/ )[ 0 ]; | ||
| sectionLink.href = `${link}?q=${search}`; | ||
| sectionLink.href = `${link}?q=${encodeURIComponent(search)}`; | ||
|
|
|
|
||
| }; | ||
|
|
||
| iframe.src = splitHash[ 0 ] + '.html' + splitHash[ 1 ]; |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium documentation
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the problem, we need to validate the user input before using it to construct the URL for the iframe. One way to do this is to maintain a list of authorized page names and only allow redirection to those pages. This ensures that the redirection is limited to known, safe URLs.
We will:
- Create a list of authorized page names.
- Check if the
splitHash[0]value is in the list of authorized page names before constructing the URL. - If the value is not authorized, we will not perform the redirection.
| @@ -517,2 +517,5 @@ | ||
|
|
||
| // List of authorized page names | ||
| const authorizedPages = ['Geometry', 'Material', 'Texture', 'Light', 'Camera']; | ||
|
|
||
| // Creating a new Iframe instead of assigning a new src is | ||
| @@ -531,3 +534,3 @@ | ||
|
|
||
| if ( hash && titles[ splitHash[ 0 ] ] ) { | ||
| if ( hash && titles[ splitHash[ 0 ] ] && authorizedPages.includes(splitHash[ 0 ]) ) { | ||
|
|
|
|
||
| }; | ||
|
|
||
| iframe.src = splitHash[ 0 ] + '.html' + splitHash[ 1 ]; |
Check failure
Code scanning / CodeQL
Client-side cross-site scripting High documentation
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the problem, we need to sanitize the user-provided input from window.location.hash before using it to construct the iframe.src URL. This can be done by encoding the input to ensure that any potentially malicious characters are neutralized. We can use the encodeURIComponent function to encode the parts of the URL.
- Modify the
createNewIframefunction to sanitize thesplitHashvalues before using them. - Specifically, apply
encodeURIComponenttosplitHash[0]andsplitHash[1]before concatenating them to form theiframe.srcURL.
| @@ -539,3 +539,3 @@ | ||
|
|
||
| iframe.src = splitHash[ 0 ] + '.html' + splitHash[ 1 ]; | ||
| iframe.src = encodeURIComponent(splitHash[ 0 ]) + '.html' + encodeURIComponent(splitHash[ 1 ]); | ||
| subtitle = titles[ splitHash[ 0 ] ] + splitHash[ 1 ] + ' – '; |
Reverts #30748